Remove 2021 Remove Business Services Remove Security
article thumbnail

New LockFile ransomware gang uses ProxyShell and PetitPotam exploits

Security Affairs

The popular security expert Kevin Beaumont was one of the first researchers to report that the LockFile operators are using the Microsoft Exchange ProxyShell and the Windows PetitPotam vulnerabilities to take over Windows domains. financial organization on July 20, 2021, with its latest activity seen as recently as August 20.

article thumbnail

Over 500,000 people were impacted by a ransomware attack that hit Morley

Security Affairs

Business services firm Morley was hit by a ransomware attack that may have exposed data of +500,000 individuals. Business services company Morley was victim of a ransomware attack that may have resulted in a data breach impacting more than 500,000 individuals. ” Follow me on Twitter: @securityaffairs and Facebook.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

TinyNuke banking malware targets French organizations

Security Affairs

The TinyNuke malware is back and now was used in attacks aimed at French users working in manufacturing, technology, construction, and business services. “After only observing a handful of TinyNuke campaigns in 2019 and 2020, Proofpoint observed TinyNuke reappear in January 2021 in one campaign distributing around 2,000 emails.

article thumbnail

LockFile Ransomware uses a new intermittent encryption technique

Security Affairs

The popular security expert Kevin Beaumont was one of the first researchers to report that the LockFile operators are using the Microsoft Exchange ProxyShell and the Windows PetitPotam vulnerabilities to take over Windows domains. .” The HTA ransom note used by LockFile closely resembles the one used by LockBit 2.0

article thumbnail

Telco service provider giant Syniverse had unauthorized access since 2016

Security Affairs

Syniverse service provider discloses a security breach, threat actors have had access to its databases since 2016 and gained some customers’ credentials. Syniverse provides text messaging routing services to hundreds of mobile operators, including AT&T, T-Mobile, Verizon, Telefonica, China Mobile, and Vodafone.

Access 308
article thumbnail

Balikbayan Foxes group spoofs Philippine gov to spread RATs

Security Affairs

The group focuses on Shipping/Logistics, Manufacturing, Business Services, Pharmaceutical, and Energy entities, among others. The threat actors restarted their activity in September 2021, they used phishing messages masqueraded as the Philippines Bureau of Customs CPRS and contained links to a credential harvesting page. .

article thumbnail

New Leak Shows Business Side of China’s APT Menace

Krebs on Security

Security experts who reviewed the leaked data say they believe the information is legitimate, and that i-SOON works closely with China’s Ministry of State Security and the military. In 2021, the Sichuan provincial government named i-SOON as one of “the top 30 information security companies.”